Suno data breach exposed 55.3M users, per Have I Been Pwned

A cyberattack on AI music generator Suno last year allowed a hacker to steal the personal information of more than 55.3 million people, according to data breach notification service Have I Been Pwned, offering the first look at the scale of the theft.

Have I Been Pwned, which obtained a copy of the breached dataset, said the stolen data included customers’ names, physical addresses, email addresses, phone numbers, purchase histories, and partial payment card numbers — including card expiry dates — taken from the company’s Stripe account.

The breach took place in November 2025 but was only recently revealed, following reporting by independent outlet 404 Media.

The stolen data also included Suno’s source code, which revealed how the company allegedly scraped millions of songs and lyrics from popular streaming sites, including Deezer, Genius, and YouTube, to train its AI models. Several major record labels are currently suing Suno, alleging that its mass-scraping practices violate copyright law.

Suno has not publicly disclosed the cyberattack or notified affected individuals that their information was taken. Suno co-founder Mikey Shulman did not respond to a request for comment on the incident.

After publication, Suno spokesperson Rachel Racusen did not dispute the number of affected users, and confirmed the company experienced a security incident in November 2025. It remains unclear why the company has not yet publicly acknowledged the breach on its website, and the company did not provide any communication it may have sent to users informing them of the breach.

Why it matters

The breach adds a data-security dimension to Suno’s mounting legal exposure over how it trained its models, at a moment when AI companies’ data practices — both what they collect from users and what they scrape to build models — are drawing sharper scrutiny.